Multiple Public IP and No Joy

[Atl_Gator]

I definitely appreciate the prior help.  Attached is my updated ASA 5505 (8.4[2]) config.

With this config, basically the "laptop" group works fine, but the leo and orion groups don't

ever receive packets inbound.  No DNS, nothing.

The laptop is windows, the other two are servers with two NICs.  The interface cards are

Intel Pro/1000s.   I've been through everything including Vlan protocol conflicts and

actually enaled the servers for 802.1(Q).

Anyway - I'm stumped ...

Anyone see anything obvious here?  Or can recommend a different piece of gear that

can actually work in this scenario?

[Atl_Gator]

The interface settings don't allow a subnet of 255.255.255.255.

Additionally (curiously) if I change the host objects to "Network" and then specify the IP and subnet mask, it just

converts them to a a Host object so it means the same thing despite the object type difference.

I can see how this issue of one IP with a subnet mask blocking another NAT rule could happen but I'm still not sure how to tell it to handle the NAT rules in an isolated manner.

[varrao · Accepted solution]

Hi,

There are two different things here:

The interface settings would take the whole subnet mask, which would be 255.255.255.0

Second, if you are creating a object network and specifying a single host, then mask would be 255.255.255.255

Thanks,

Varun

[Atl_Gator]

Yep ... however, when you specify that mask for a network object it just converts it to a host object (as was originally created).  I.e., if you create a network object and then edit it, it just drops the 255.255.255.255 and says it is a host object, as would be obvious.

So - still no joy.    I am trying the arp-mac alias thing now that others have talked about online, got the MAC aliases in to point to the outside inbound interface for the NAT-ed public IPs and .... nope. LOL

[Atl_Gator]

Okay - actually, I got it working for the test config and have successfully nat-ted multiple IPs to different hosts with the switch, but, it's not the servers as yet.  The "show xlate" was useful.  There had been a typo.

I'm still not sure this will work in production because the servers were just acting weird, but seeing it work in test is a huge boost.

Thanks Varun!

Did further testing and added all the old nats and swapped them around and the two in the lab are still working ... okay, production test tomorrow night (fingers crossed).

[Atl_Gator]

After a hellish week, finally isolated the issue.   We couldn't allow  for any downtime in swapping the ASA in and out so the 4 hour timeout  on the ARP caches was never reached.

The ISP router ARP caches simply were ignoring our  gear.  The fix was to get the MAC from the old router and enter it in  the new one as a clone and as soon as we did that, everything went live  and pretty.

It is a great device.  The upside is this hellish experience probably turned me into a baby-CCIE.

Thank you everyone for all the help.

If anyone has this issue again, just wait 4 hours or get the old router WAN MAC address and use the interfaces tab to clone it.